I was testing an internal application recently, that had fully permissive CORS, i.e. it echoes the Origin header into Access-Control-Allow-Origin, has Access-Control-Allow-Credentials: true and handles OPTIONS properly. All the pieces were in place - but I couldn't get a POC to work. Both Chrome and Firefox were simply sending the cross-origin request without a preflight, and without attaching credentials (and yes, I had set withCredentials on the request).
Seems to me that there is some kind of security control in place to stop internet sites attacking intranet sites? I couldn't find any info on such a filter online, and I'm not entirely sure how it would work - although I can see that it would be a good security feature. Possibly this feature has broader applicability than just CORS.
There was no "fancy stuff" enabled like CSP or CORB.